Search for packages
| purl | pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.0 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 10.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-hgrr-935x-pq79
Aliases: CVE-2025-61795 |
Apache Tomcat Vulnerable to Improper Resource Shutdown or Release If an error occurred (including exceeding limits) during the processing of … | There are no reported fixed by versions. |
|
GHSA-h2fw-rfh5-95r3
Aliases: CVE-2025-46701 |
Apache Tomcat - CGI security constraint bypass Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security … | There are no reported fixed by versions. |
|
GHSA-wr62-c79q-cv37
Aliases: CVE-2025-52520 |
Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits For some unlikely configurations of multipart upload, … | There are no reported fixed by versions. |
|
GHSA-25xr-qj8w-c4vf
Aliases: CVE-2025-53506 |
Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams Uncontrolled Resource Consumption vulnerability in Apache Tomcat if … | There are no reported fixed by versions. |
|
GHSA-83qj-6fr2-vhqg
Aliases: CVE-2025-24813 |
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT Path Equivalence: 'file.Name' (Internal Dot) leading to … | There are no reported fixed by versions. |
|
GHSA-p22x-g9px-3945
Aliases: CVE-2022-42252 |
Apache Tomcat may reject request containing invalid Content-Length header If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to … |
Vulnerable |
|
GHSA-9xcj-c8cr-8c3c
Aliases: CVE-2019-17563 |
In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation … |
Vulnerable |
|
GHSA-5j33-cvvr-w245
Aliases: CVE-2024-50379 |
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat … | There are no reported fixed by versions. |
|
GHSA-wm9w-rjj3-j356
Aliases: CVE-2024-34750 |
Apache Tomcat - Denial of Service Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing … | There are no reported fixed by versions. |
|
GHSA-g8pj-r55q-5c2v
Aliases: CVE-2023-42795 |
Apache Tomcat Incomplete Cleanup vulnerability Incomplete Cleanup vulnerability in Apache Tomcat. When recycling various internal objects in Apache Tomcat from … |
Vulnerable |
|
GHSA-r6j3-px5g-cq3x
Aliases: CVE-2023-45648 |
Apache Tomcat Improper Input Validation vulnerability Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 … |
Vulnerable |
|
GHSA-qppj-fm5r-hxr3
Aliases: CVE-2023-44487 |
HTTP/2 Stream Cancellation Attack ## HTTP/2 Rapid reset attack The HTTP/2 protocol allows clients to indicate to the server that … |
Vulnerable |
|
GHSA-q3mw-pvr8-9ggc
Aliases: CVE-2023-41080 |
Apache Tomcat Open Redirect vulnerability URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue … |
Vulnerable |
|
GHSA-gx5v-xp9w-j4cg
Aliases: CVE-2026-41284 |
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 … |
Vulnerable |
|
GHSA-5mp6-jrq3-r938
Aliases: CVE-2026-43513 |
Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This … |
Vulnerable |
|
GHSA-5m62-pw8w-7w9f
Aliases: CVE-2026-43515 |
Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 … |
Vulnerable |
|
GHSA-fv25-8xcx-gqjc
Aliases: CVE-2026-42498 |
Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache … |
Vulnerable |
|
GHSA-h6fc-48rj-7qqh
Aliases: CVE-2026-43512 |
Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 … |
Vulnerable |
|
GHSA-9m89-8frq-c98c
Aliases: CVE-2026-43514 |
Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to … |
Vulnerable |
|
GHSA-qxf4-chvg-4r8r
Aliases: CVE-2020-1935 |
Potential HTTP request smuggling in Apache Tomcat In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 … |
Vulnerable |
|
GHSA-c9hw-wf7x-jp9j
Aliases: CVE-2020-1938 |
Improper Privilege Management in Tomcat When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections … |
Vulnerable |
|
CVE-2022-42252
Aliases: GHSA-p22x-g9px-3945 |
Improper Input Validation If Apache Tomcat 8.5.0 to 8.5.52, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2022-25762
Aliases: GHSA-h3ch-5pp2-vh6w |
Improper Resource Shutdown or Release If a web application sends a WebSocket message concurrently with the WebSocket connection closing when … |
Vulnerable Vulnerable |
|
CVE-2019-12418
Aliases: GHSA-hh3j-x4mc-g48r |
In Apache Tomcat, a local attacker may be able to perform a man-in-the-middle attack to capture user names and passwords … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2017-7675
|
Path Traversal The HTTP/2 implementation in Tomcat bypassed a number of security checks that prevented directory traversal attacks. It was … |
Vulnerable Vulnerable |
|
CVE-2017-5650
|
Improper Resource Shutdown or Release The handling of an HTTP/2 `GOAWAY` frame for a connection did not close streams associated … |
Vulnerable Vulnerable |
|
CVE-2021-25329
|
Uncontrolled Resource Consumption The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat with a configuration edge case that was … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2016-6794
|
Information Exposure When a `SecurityManager` is configured, a web application's ability to read system properties should be controlled by the … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2017-5664
|
Improper Handling of Exceptional Conditions The error page mechanism of the Java Servlet Specification requires that, when an error occurs … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2021-30640
|
Improper Authentication A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2017-5648
|
Exposure of Resource to Wrong Sphere Some calls to application listeners in Apache Tomcat did not use the appropriate facade … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2017-5651
|
Information Exposure The refactoring of the HTTP connectors introduced a regression in the send file processing. If the file processing … |
Vulnerable Vulnerable |
|
CVE-2016-8745
|
Information Exposure A bug in the error handling of the NIO HTTP connector in Apache Tomcat resulted in the current … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2021-41079
|
Improper Input Validation Apache Tomcat does not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-5q99-f34m-67gc
Aliases: CVE-2018-11784 |
Apache Tomcat Open Redirect vulnerability When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and … |
Vulnerable Vulnerable |
|
GHSA-8vmx-qmch-mpqg
Aliases: CVE-2019-0232 |
Apache Tomcat OS Command Injection vulnerability When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 … |
Vulnerable Vulnerable |
|
GHSA-q4hg-rmq2-52q9
Aliases: CVE-2019-10072 |
Improper Locking in Apache Tomcat The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on … |
Vulnerable Vulnerable |
|
GHSA-jjpq-gp5q-8q6w
Aliases: CVE-2019-0221 |
Cross-site scripting in Apache Tomcat The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-qcxh-w3j9-58qr
Aliases: CVE-2019-0199 |
Apache Tomcat Denial of Service vulnerability The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted … |
Vulnerable Vulnerable |
|
GHSA-4j3c-42xv-3f84
Aliases: CVE-2025-52434 |
Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector Concurrent Execution using Shared Resource with Improper Synchronization … | There are no reported fixed by versions. |
|
CVE-2025-52434
Aliases: GHSA-4j3c-42xv-3f84 |
Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector Concurrent Execution using Shared Resource with Improper Synchronization … |
Vulnerable |
|
CVE-2019-10072
Aliases: GHSA-q4hg-rmq2-52q9 |
Improper Locking The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2025-61795
Aliases: GHSA-hgrr-935x-pq79 |
Apache Tomcat Vulnerable to Improper Resource Shutdown or Release If an error occurred (including exceeding limits) during the processing of … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-11996
Aliases: GHSA-53hp-jpwq-2jgq |
Uncontrolled Resource Consumption in Apache Tomcat A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2023-28708
Aliases: GHSA-2c9m-w27f-53rm |
Unprotected Transport of Credentials When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2021-43980
|
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') The simplified implementation of blocking reads and writes introduced in … | There are no reported fixed by versions. |
|
GHSA-j39c-c8hj-x4j3
Aliases: CVE-2021-25122 |
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat When responding to new h2c connection requests, Apache Tomcat … |
Vulnerable Vulnerable |
|
GHSA-r29c-68gh-xp6x
Aliases: CVE-2026-41293 |
Apache Tomcat - HTTP/2 request headers not validated Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 … |
Vulnerable Vulnerable |
|
GHSA-fpj8-gq4v-p354
Aliases: CVE-2025-66614 |
Apache Tomcat - Client certificate verification bypass Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, … |
Vulnerable |
|
GHSA-9xv2-5v5q-p794
Aliases: CVE-2026-65905 |
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST … | There are no reported fixed by versions. |
|
GHSA-gcx9-497g-6cp6
Aliases: CVE-2026-65182 |
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads … | There are no reported fixed by versions. |
|
GHSA-h3x4-894j-xpx5
Aliases: CVE-2026-68525 |
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows … | There are no reported fixed by versions. |
|
GHSA-m59c-jpc8-m2x4
Aliases: CVE-2018-1336 |
In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder An improper handing of overflow in … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-jx6h-3fjx-cgv5
Aliases: CVE-2018-1305 |
Apache Tomcat information exposure vulnerability Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-46j3-r4pj-4835
Aliases: CVE-2018-8034 |
The host name verification missing in Apache Tomcat The host name verification when using TLS with the WebSocket client was … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-6rxj-58jh-436r
Aliases: CVE-2018-1304 |
Apache Tomcat unauthorized access vulnerability The URL pattern of "" (the empty string) which exactly maps to the context root … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-r4x2-3cq5-hqvp
Aliases: CVE-2018-8014 |
The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins The … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-2rvv-w9r2-rg7m
Aliases: CVE-2021-24122 |
Information Disclosure in Apache Tomcat When serving resources from a network location using the NTFS file system, Apache Tomcat versions … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-jgwr-3qm3-26f3
Aliases: CVE-2021-25329 |
Potential remote code execution in Apache Tomcat The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, … |
Vulnerable Vulnerable |
|
GHSA-ff77-26x5-69cr
Aliases: CVE-2025-31651 |
Apache Tomcat Rewrite rule bypass Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset … |
Vulnerable |
|
GHSA-3p2h-wqq4-wf4h
Aliases: CVE-2025-31650 |
Apache Tomcat Denial of Service via invalid HTTP priority header Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling … |
Vulnerable |
|
GHSA-wc4r-xq3c-5cf3
Aliases: CVE-2025-49125 |
Apache Tomcat - Security constraint bypass for pre/post-resources Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-h3gc-qfqq-6h8f
Aliases: CVE-2025-48988 |
Apache Tomcat - DoS in multipart upload Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-53hp-jpwq-2jgq
Aliases: CVE-2020-11996 |
Uncontrolled Resource Consumption in Apache Tomcat A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-3vx3-xf6q-r5xp
Aliases: CVE-2017-5648 |
Exposure of Resource to Wrong Sphere in Apache Tomcat While investigating bug 60718, it was noticed that some calls to … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-xjgh-84hx-56c5
Aliases: CVE-2017-12617 |
Unrestricted Upload of File with Dangerous Type Apache Tomcat When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-9hg2-395j-83rm
Aliases: CVE-2017-5651 |
Expected Behavior Violation in Apache Tomcat In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-r53m-pfr5-7v87
|
Moderate severity vulnerability that affects org.apache.tomcat.embed:tomcat-embed-core **Withdrawn:** Duplicate of GHSA-qcxh-w3j9-58qr |
Vulnerable Vulnerable Vulnerable |
|
GHSA-hh3j-x4mc-g48r
Aliases: CVE-2019-12418 |
Insufficiently Protected Credentials in Apache Tomcat When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured … |
Vulnerable Vulnerable |
|
GHSA-7w75-32cg-r6g2
Aliases: CVE-2024-24549 |
Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests Denial of Service due to improper … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-fccv-jmmp-qg76
Aliases: CVE-2023-46589 |
Apache Tomcat Improper Input Validation vulnerability Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 … |
Vulnerable Vulnerable |
|
GHSA-563x-q5rq-57qp
Aliases: CVE-2026-24880 |
Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-344f-f5vg-2jfj
Aliases: CVE-2020-9484 |
Potential remote code execution in Apache Tomcat When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2026-55276
Aliases: GHSA-mqg3-r7h5-24x4 |
Apache Tomcat - Logged effective web.xml is incomplete Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-65905
Aliases: GHSA-9xv2-5v5q-p794 |
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST … |
Vulnerable Vulnerable |
|
CVE-2026-59083
Aliases: GHSA-hcjr-322h-429r |
Apache Tomcat - Incorrect URL decoding in RewriteValve may allow security control bypass Improper Handling of URL Encoding (Hex Encoding) … |
Vulnerable Vulnerable Vulnerable |